From fbc1f1822a84d14da5c1f822c4394aee67472292 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 30 Jul 2026 15:43:14 +0700
Subject: [PATCH] fix: deploy via SSH, build + deploy on VPS directly

The CI runner container can't access the VPS host's systemd and Nix
directly. Instead of installing Nix in the container and trying to
access the host, SSH directly to the VPS to build and deploy.

This approach:
1. SSHs to the VPS using the VPS_SSH_KEY_VALUE secret
2. Pulls the latest code on the VPS
3. Builds with Nix directly on the VPS
4. Updates nix-env profile and restarts systemd service

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .gitea/workflows/deploy.yml | 60 +++++++++++++++++++++----------------
 1 file changed, 35 insertions(+), 25 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index ba6e893..b1c95c5 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -13,33 +13,43 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v4
 
-      - name: Install Nix
-        run: |
-          curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix \
-            | sh -s -- install --no-confirm 2>&1
-          echo "/nix/var/nix/profiles/default/bin" >> "$GITHUB_PATH"
-
-      - name: Build with Nix
-        run: |
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh || true
-          nix build .#teleuploader --impure --option sandbox false 2>&1
-
-      - name: Deploy via Docker socket (host access)
+      - name: Deploy via SSH (build + deploy on VPS)
+        env:
+          VPS_HOST: ${{ secrets.VPS_HOST }}
+          VPS_USER: ${{ secrets.VPS_USER }}
+          VPS_SSH_KEY_VALUE: ${{ secrets.VPS_SSH_KEY_VALUE }}
         run: |
           set -eu
-          STORE_PATH=$(readlink result)
+          key_file=$(mktemp)
+          printf '%s\n' "$VPS_SSH_KEY_VALUE" > "$key_file"
+          chmod 600 "$key_file"
 
-          # Use Docker socket to run commands on the VPS host
-          docker run --rm --pid=host --privileged \
-            -v /:/host \
-            alpine:latest \
-            chroot /host sh -c "
-              nix-env --profile /nix/var/nix/profiles/teleuploader --set '$STORE_PATH' && \
-              systemctl restart teleuploader
+          ssh -i "$key_file" -o StrictHostKeyChecking=no \
+            "${VPS_USER}@${VPS_HOST}" \
             "
 
-          echo "=== Service status ==="
-          docker run --rm --pid=host --privileged \
-            -v /:/host \
-            alpine:latest \
-            chroot /host sh -c "systemctl status teleuploader --no-pager | head -15"
+            # Source Nix profile (Determinate Nix installs to ~/.nix-profile)
+            export PATH=\"\$HOME/.nix-profile/bin:\$PATH\"
+
+            # Clone or pull latest code
+            REPO_DIR=\"/home/teleuploader/repo\"
+            if [ -d \"\$REPO_DIR/.git\" ]; then
+              cd \"\$REPO_DIR\" && git pull origin main 2>&1
+            else
+              mkdir -p \"\$REPO_DIR\"
+              git clone https://git.imrnes.team/MythEclipse/TeleUploader \"\$REPO_DIR\" 2>&1
+              cd \"\$REPO_DIR\"
+            fi
+
+            cd \"\$REPO_DIR\"
+
+            # Build with Nix
+            nix build .#teleuploader --impure --option sandbox false 2>&1
+
+            # Deploy
+            STORE_PATH=\$(readlink result)
+            nix-env --profile /nix/var/nix/profiles/teleuploader --set \"\$STORE_PATH\"
+            systemctl restart teleuploader
+            sleep 3
+            systemctl status teleuploader --no-pager | head -15
+            "